6370fba15018f8da32229c4aeff87efc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6370fba15018f8da32229c4aeff87efc_JaffaCakes118
Size

72KB
MD5

6370fba15018f8da32229c4aeff87efc
SHA1

670d49c1cb4ff572ea7c950efeb8fd3fb230fc81
SHA256

578ab3cfc1b1e2132f0ba8162fe4791c2020f08db9e33b57661fd3cae8d69c06
SHA512

955816954ddc14106d309bc12ff185e05b8f3fac236415767e9eb25a8d9fe89566b9fa17983a1fdf19b82bf313793198ee892db0490f3378e3a2ff3e8ce3d28d
SSDEEP

1536:B7UAtswIixWbO8CVsUm+2cvteBsYibwy5IGtIoiCU:B7UAuwiO8CVsUm+7cBubTi5oiCU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6370fba15018f8da32229c4aeff87efc_JaffaCakes118

Files

6370fba15018f8da32229c4aeff87efc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b6bd4f6b6d30f76ee25219bf3b803b43

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetExitCodeThread
CreateThread
DeviceIoControl
CreateFileA
GetVersionExA
GetVolumeInformationA
WaitForSingleObject
CreateProcessA
GetCurrentThreadId
TerminateProcess
lstrcmpiA
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
LeaveCriticalSection
EnterCriticalSection
VirtualAllocEx
OpenProcess
GetCurrentProcess
DeleteCriticalSection
GetCurrentProcessId
InitializeCriticalSection
GetTickCount
CloseHandle
GetModuleFileNameA
ReleaseMutex
GetLastError
CreateMutexA
CompareStringW
CompareStringA
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
VirtualFree
OutputDebugStringA
GetSystemDirectoryA
GetWindowsDirectoryA
lstrcatA
lstrlenA
lstrcpyA
lstrcpynA
CopyFileA
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetProcAddress
WideCharToMultiByte
HeapAlloc
HeapFree
GetOEMCP
ExitProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
GetFileAttributesA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
WriteFile
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetCPInfo
GetACP
SetEnvironmentVariableA

user32

SendMessageA
GetWindowLongA
GetClassNameA
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
FindWindowA
GetThreadDesktop
CreateDesktopA
SetThreadDesktop
SwitchDesktop
CloseDesktop
EnumDesktopWindows
GetSystemMetrics

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegRestoreKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

ShellExecuteA

netapi32

Netbios

wininet

HttpQueryInfoA
InternetOpenA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

urlmon

URLDownloadToFileA

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b6bd4f6b6d30f76ee25219bf3b803b43

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

netapi32

wininet

urlmon

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 120KB

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 120KB